What is Write-what-where Condition (CWE-123)?

TL;DR: A write-what-where condition occurs when an attacker can write an arbitrary value to an arbitrary location, often as a result of a buffer overflow. Detection and prevention involve manual testing, automated scanners (SAST / DAST), and secure coding practices.

At-a-Glance

What is Write-what-where Condition?

Write-what-where Condition (CWE-123) is a type of vulnerability that occurs when an attacker can write an arbitrary value to an arbitrary location, often as a result of a buffer overflow. As defined by the MITRE Corporation under CWE-123, and classified by the OWASP Foundation under No official mapping…

Quick Summary

A write-what-where condition is a serious security vulnerability that can have significant business impacts. It occurs when an attacker can write an arbitrary value to an arbitrary location, often as a result of a buffer overflow. Detection and prevention involve manual testing, automated scanners (SAST / DAST), and secure coding practices.

Jump to: Quick Summary · Write-what-where Condition Overview · How Write-what-where Condition Works · Business Impact of Write-what-where Condition · Write-what-where Condition Attack Scenario · How to Detect Write-what-where Condition · How to Fix Write-what-where Condition · Framework-Specific Fixes for Write-what-where Condition · How to Ask AI to Check Your Code for Write-what-where Condition · Write-what-where Condition Best Practices Checklist · Write-what-where Condition FAQ · Vulnerabilities Related to Write-what-where Condition · References · Scan Your Own Site

Write-what-where Condition Overview

What

A write-what-where condition is a type of vulnerability that occurs when an attacker can write an arbitrary value to an arbitrary location, often as a result of a buffer overflow.

Why it matters

This type of vulnerability can have significant business impacts, including financial losses, compliance issues, and reputational damage. It is essential to detect and fix this type of vulnerability to prevent these consequences.

Where it occurs

Write-what-where conditions typically occur in systems that use buffers or other memory structures to store data.

Who is affected

Any system that uses buffers or other memory structures to store data can be vulnerable to write-what-where conditions.

Who is NOT affected

Systems that do not use buffers or other memory structures to store data are not typically vulnerable to write-what-where conditions.

How Write-what-where Condition Works

Root Cause

The root cause of a write-what-where condition is often related to buffer overflows or other memory safety issues.

Attack Flow

1. An attacker sends a malicious input to the system.
2. The system processes the input and stores it in a buffer.
3. The attacker exploits the buffer overflow vulnerability by writing an arbitrary value to an arbitrary location.

Prerequisites to Exploit

• A buffer overflow vulnerability must exist in the system.
• The attacker must be able to send malicious input to the system.

Vulnerable Code

void vulnerable_function(char *input) {
  char buffer[10];
  strcpy(buffer, input);
}

This code is vulnerable to a write-what-where condition because it uses the strcpy function to copy user input into a buffer without checking its length. This allows an attacker to overflow the buffer and write arbitrary data to an arbitrary location.

Secure Code

void secure_function(char *input) {
  char buffer[10];
  strncpy(buffer, input, sizeof(buffer) - 1);
  buffer[sizeof(buffer) - 1] = '\0';
}

This code is secure because strncpy is bounded to one byte less than the buffer size, and the last byte is explicitly null-terminated — strncpy alone does not guarantee null-termination when the source is as long as or longer than the destination, so that explicit terminator is required, not optional.

Business Impact of Write-what-where Condition

Confidentiality

• Data confidentiality can be compromised if an attacker can write arbitrary data to sensitive locations.
• Examples include writing malicious code to the system’s configuration files or overwriting sensitive data in memory.

Integrity

• Data integrity can be compromised if an attacker can modify arbitrary data.
• Examples include modifying system settings, configuration files, or sensitive data in memory.

Availability

• System availability can be compromised if an attacker can cause a denial-of-service (DoS) attack by writing arbitrary data to critical locations.
• Examples include overwriting the system’s boot sector or causing a kernel panic.

Write-what-where Condition Attack Scenario

1. An attacker sends a malicious input to the system.
2. The system processes the input and stores it in a buffer.
3. The attacker exploits the buffer overflow vulnerability by writing an arbitrary value to an arbitrary location.

How to Detect Write-what-where Condition

Manual Testing

• Use manual testing techniques such as fuzz testing or code review to detect write-what-where conditions.
• Examples include using tools like American Fuzzy Lop (AFL) or Valgrind to detect buffer overflows.

Automated Scanners (SAST / DAST)

• Use automated scanners to detect write-what-where conditions in your code.
• Examples include using tools like Coverity Scan, Veracode, or Fortify SCA.

PenScan Detection

PenScan’s scanner engines actively test for this issue. Use our free scan tool to identify and fix CWE-123 vulnerabilities.

False Positive Guidance

A write to a pointer or index that is fully validated against a known-good range immediately beforehand — with no attacker-reachable path around that check — is not a real write-what-where condition, even if the underlying pattern (pointer arithmetic feeding a write) looks superficially similar to one.

How to Fix Write-what-where Condition

• Address the root cause of the issue by fixing buffer overflows or other memory safety issues.
• Examples include using secure coding practices, such as bounds checking and input validation.

Framework-Specific Fixes for Write-what-where Condition

C/C++

void fix_function(char *input) {
  char buffer[10];
  strncpy(buffer, input, sizeof(buffer));
}

This code is a framework-specific fix for the write-what-where condition in C/C++.

How to Ask AI to Check Your Code for Write-what-where Condition

Review the following [language] code block for potential CWE-123 Write-what-where Condition vulnerabilities and rewrite it using primary fix technique: [paste code here]

Write-what-where Condition Best Practices Checklist

✅ Use secure coding practices, such as bounds checking and input validation. ✅ Address the root cause of the issue by fixing buffer overflows or other memory safety issues.

Write-what-where Condition FAQ

How do I define a write-what-where condition?

A write-what-where condition occurs when an attacker can write an arbitrary value to an arbitrary location, often as a result of a buffer overflow.

What are the common consequences of a write-what-where condition?

The common consequences include modify memory, execute unauthorized code or commands, gain privileges or assume identity, DoS: crash, exit, or restart, and bypass protection mechanism.

How do I detect a write-what-where condition?

Detection of a write-what-where condition typically involves manual testing and the use of automated scanners (SAST / DAST).

What is the root cause of a write-what-where condition?

The root cause of a write-what-where condition is often related to buffer overflows or other memory safety issues.

How do I prevent a write-what-where condition?

Prevention of a write-what-where condition typically involves using language selection, OS-level preventative functionality, and secure coding practices.

What are the business impacts of a write-what-where condition?

The business impacts of a write-what-where condition can include financial losses, compliance issues, and reputational damage.

How do I fix a write-what-where condition?

Fixing a write-what-where condition typically involves addressing the root cause of the issue, such as fixing buffer overflows or other memory safety issues.

Vulnerabilities Related to Write-what-where Condition

References

• MITRE CWE-123
• CAPEC None known
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Write-what-where Condition and other risks before an attacker does.